LiteLLM MCP test-endpoint command injection chained to unauthenticated RCE (CVE-2026-42271)

CVE-2026-42271 is a command-injection flaw in BerriAI's LiteLLM, the open-source AI gateway/proxy routing across many LLM providers. Per the maintainers' advisory and Horizon3.ai, two endpoints meant to preview an MCP server before saving — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full stdio server config (command, args, env) and, when invoked, spawned the supplied command as a subprocess on the proxy host as the LiteLLM process user. CVSS reportedly 8.7; affects versions >= 1.74.2 and < 1.83.7; patched in 1.83.7 (reportedly released 8 May 2026). As disclosed 20 Apr 2026 it required a valid proxy API key; Horizon3.ai then showed chaining CVE-2026-48710 (a Starlette 'BadHost' Host-header validation bypass, <= 1.0.0, disclosed 26 May 2026) sidesteps auth entirely for unauthenticated RCE (combined CVSS reportedly 10.0), validated 1 Jun 2026. On 8 Jun 2026 CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog citing in-the-wild exploitation. Successful exploitation runs arbitrary commands on the gateway host and reaches the multi-provider LLM API keys the proxy concentrates. Distinct from the March 2026 TeamPCP PyPI supply-chain compromise: here the shipped gateway itself acts as a confused deputy executing an attacker-supplied MCP 'connection test' command. Figures, CVSS scores and the exploitation assessment are as reported; endpoint and payload details are illustrative.